H. Res. 164 

In the House of Representatives, U. S., 

April 17, 2013. 

Resolved, That at any time after the adoption of this resolution the Speaker may, pursuant to clause 2(b) of rule 

XVIII, declare the House resolved into the Committee of the 

Whole House on the state of the Union for consideration of 

the bill (H.R. 624) to provide for the sharing of certain cyber 

threat intelligence and cyber threat information between the 

intelligence community and cybersecurity entities, and for 

other purposes. The first reading of the bill shall be dispensed with. All points of order against consideration of the 

bill are waived. General debate shall be confined to the bill 

and shall not exceed one hour equally divided and controlled 

by the chair and ranking minority member of the Permanent 

Select Committee on Intelligence. After general debate the 

bill shall be considered for amendment under the five-minute 

rule. In lieu of the amendment in the nature of a substitute 

recommended by the Permanent Select Committee on Intelligence now printed in the bill, it shall be in order to consider 

as an original bill for the purpose of amendment under the 
2 

•HRES 164 EH 

five-minute rule an amendment in the nature of a substitute 

consisting of the text of Rules Committee Print 113–7. That 

amendment in the nature of a substitute shall be considered 

as read. All points of order against that amendment in the 

nature of a substitute are waived. No amendment to that 

amendment in the nature of a substitute shall be in order except those printed in the report of the Committee on Rules 

accompanying this resolution. Each such amendment may be 

offered only in the order printed in the report, may be offered 

only by a Member designated in the report, shall be considered as read, shall be debatable for the time specified in the 

report equally divided and controlled by the proponent and an 

opponent, shall not be subject to amendment, and shall not 

be subject to a demand for division of the question in the 

House or in the Committee of the Whole. All points of order 

against such amendments are waived. At the conclusion of 

consideration of the bill for amendment the Committee shall 

rise and report the bill to the House with such amendments 

as may have been adopted. Any Member may demand a separate vote in the House on any amendment adopted in the 

Committee of the Whole to the bill or to the amendment in 

the nature of a substitute made in order as original text. The 

previous question shall be considered as ordered on the bill 

and amendments thereto to final passage without intervening 
3 

•HRES 164 EH 

motion except one motion to recommit with or without instructions. 

SEC. 2. Notwithstanding any other provision of this resolution, the amendment specified in section 3 shall be in 

order as though printed as the last amendment in House Report 113–41 if offered by Representative McCaul of Texas or 

his designee. That amendment shall be debatable for 10 minutes equally divided and controlled by the proponent and an 

opponent. 

SEC. 3. The amendment referred to in section 2 is as 

follows: After section 1, insert the following new section (and 

renumber subsequent sections accordingly): 

‘‘SEC. 2. FEDERAL GOVERNMENT COORDINATION WITH RESPECT TO CYBERSECURITY. 

‘‘(a) COORDINATED ACTIVITIES.—The Federal Government shall conduct cybersecurity activities to provide shared 

situational awareness that enables integrated operational actions to protect, prevent, mitigate, respond to, and recover 

from cyber incidents. 

‘‘(b) COORDINATED INFORMATION SHARING.— 

‘‘(1) DESIGNATION OF COORDINATING ENTITY FOR

CYBER THREAT INFORMATION.—The President shall 

designate an entity within the Department of Homeland 

Security as the civilian Federal entity to receive cyber 

threat information that is shared by a cybersecurity pro-
4 

•HRES 164 EH 

vider or self-protected entity in accordance with section 

1104(b) of the National Security Act of 1947, as added 

by section 3(a) of this Act, except as provided in paragraph (2) and subject to the procedures established 

under paragraph (4). 

‘‘(2) DESIGNATION OF A COORDINATING ENTITY

FOR CYBERSECURITY CRIMES.—The President shall designate an entity within the Department of Justice as the 

civilian Federal entity to receive cyber threat information related to cybersecurity crimes that is shared by a 

cybersecurity provider or self-protected entity in accordance with section 1104(b) of the National Security Act 

of 1947, as added by section 3(a) of this Act, subject to 

the procedures under paragraph (4). 

‘‘(3) SHARING BY COORDINATING ENTITIES.—The 

entities designated under paragraphs (1) and (2) shall 

share cyber threat information shared with such entities 

in accordance with section 1104(b) of the National Security Act of 1947, as added by section 3(a) of this Act, 

consistent with the procedures established under paragraphs (4) and (5). 

‘‘(4) PROCEDURES.—Each department or agency of 

the Federal Government receiving cyber threat information shared in accordance with section 1104(b) of the 
5 

•HRES 164 EH 

National Security Act of 1947, as added by section 3(a) 

of this Act, shall establish procedures to— 

‘‘(A) ensure that cyber threat information 

shared with departments or agencies of the Federal 

Government in accordance with such section 

1104(b) is also shared with appropriate departments and agencies of the Federal Government with 

a national security mission in real time; 

‘‘(B) ensure the distribution to other departments and agencies of the Federal Government of 

cyber threat information in real time; and 

‘‘(C) facilitate information sharing, interaction, 

and collaboration among and between the Federal 

Government; State, local, tribal, and territorial governments; and cybersecurity providers and self-protected entities. 

‘‘(5) PRIVACY AND CIVIL LIBERTIES.— 

‘‘(A) POLICIES AND PROCEDURES.—The Secretary of Homeland Security, the Attorney General, 

the Director of National Intelligence, and the Secretary of Defense shall jointly establish and periodically review policies and procedures governing the 

receipt, retention, use, and disclosure of non-publicly available cyber threat information shared with 

the Federal Government in accordance with section 
6 

•HRES 164 EH 

1104(b) of the National Security Act of 1947, as 

added by section 3(a) of this Act. Such policies and 

procedures shall, consistent with the need to protect 

systems and networks from cyber threats and mitigate cyber threats in a timely manner— 

‘‘(i) minimize the impact on privacy and 

civil liberties; 

‘‘(ii) reasonably limit the receipt, retention, use, and disclosure of cyber threat information associated with specific persons that is 

not necessary to protect systems or networks 

from cyber threats or mitigate cyber threats in 

a timely manner; 

‘‘(iii) include requirements to safeguard 

non-publicly available cyber threat information 

that may be used to identify specific persons 

from unauthorized access or acquisition; 

‘‘(iv) protect the confidentiality of cyber 

threat information associated with specific persons to the greatest extent practicable; and 

‘‘(v) not delay or impede the flow of cyber 

threat information necessary to defend against 

or mitigate a cyber threat. 

‘‘(B) SUBMISSION TO CONGRESS.—The Secretary of Homeland Security, the Attorney General, 
7 

•HRES 164 EH 

the Director of National Intelligence, and the Secretary of Defense shall, consistent with the need to 

protect sources and methods, jointly submit to Congress the policies and procedures required under 

subparagraph (A) and any updates to such policies 

and procedures. 

‘‘(C) IMPLEMENTATION.—The head of each department or agency of the Federal Government receiving cyber threat information shared with the 

Federal Government under such section 1104(b) 

shall— 

‘‘(i) implement the policies and procedures 

established under subparagraph (A); and 

‘‘(ii) promptly notify the Secretary of 

Homeland Security, the Attorney General, the 

Director of National Intelligence, the Secretary 

of Defense, and the appropriate congressional 

committees of any significant violations of such 

policies and procedures. 

‘‘(D) OVERSIGHT.—The Secretary of Homeland Security, the Attorney General, the Director of 

National Intelligence, and the Secretary of Defense 

shall jointly establish a program to monitor and 

oversee compliance with the policies and procedures 

established under subparagraph (A). 
8 

•HRES 164 EH 

‘‘(6) INFORMATION SHARING RELATIONSHIPS.— 

Nothing in this section shall be construed to— 

‘‘(A) alter existing agreements or prohibit new 

agreements with respect to the sharing of cyber 

threat information between the Department of Defense and an entity that is part of the defense industrial base; 

‘‘(B) alter existing information-sharing relationships between a cybersecurity provider, protected entity, or self-protected entity and the Federal Government; 

‘‘(C) prohibit the sharing of cyber threat information directly with a department or agency of the 

Federal Government for criminal investigative purposes related to crimes described in section 

1104(c)(1) of the National Security Act of 1947, as 

added by section 3(a) of this Act; or 

‘‘(D) alter existing agreements or prohibit new 

agreements with respect to the sharing of cyber 

threat information between the Department of 

Treasury and an entity that is part of the financial 

services sector. 

‘‘(7) TECHNICAL ASSISTANCE.— 

‘‘(A) DISCUSSIONS AND ASSISTANCE.—Nothing 

in this section shall be construed to prohibit any de-
9 

•HRES 164 EH 

partment or agency of the Federal Government 

from engaging in formal or informal technical discussion regarding cyber threat information with a 

cybersecurity provider or self-protected entity or 

from providing technical assistance to address 

vulnerabilities or mitigate threats at the request of 

such a provider or such an entity. 

‘‘(B) COORDINATION.—Any department or 

agency of the Federal Government engaging in an 

activity referred to in subparagraph (A) shall coordinate such activity with the entity of the Department of Homeland Security designated under paragraph (1) and share all significant information resulting from such activity with such entity and all 

other appropriate departments and agencies of the 

Federal Government. 

‘‘(C) SHARING BY DESIGNATED ENTITY.—Consistent with the policies and procedures established 

under paragraph (5), the entity of the Department 

of Homeland Security designated under paragraph 

(1) shall share with all appropriate departments 

and agencies of the Federal Government all significant information resulting from— 

‘‘(i) formal or informal technical discussions between such entity of the Department of 
10 

•HRES 164 EH 

Homeland Security and a cybersecurity provider or self-protected entity about cyber threat 

information; or 

‘‘(ii) any technical assistance such entity 

of the Department of Homeland Security provides to such cybersecurity provider or such 

self-protected entity to address vulnerabilities 

or mitigate threats. 

‘‘(c) REPORTS ON INFORMATION SHARING.— 

‘‘(1) INSPECTOR GENERAL OF THE DEPARTMENT

OF HOMELAND SECURITY REPORT.—The Inspector General of the Department of Homeland Security, in consultation with the Inspector General of the Department 

of Justice, the Inspector General of the Intelligence 

Community, the Inspector General of the Department of 

Defense, and the Privacy and Civil Liberties Oversight 

Board, shall annually submit to the appropriate congressional committees a report containing a review of the use 

of information shared with the Federal Government 

under subsection (b) of section 1104 of the National Security Act of 1947, as added by section 3(a) of this Act, 

including— 

‘‘(A) a review of the use by the Federal Government of such information for a purpose other 

than a cybersecurity purpose; 
11 

•HRES 164 EH 

‘‘(B) a review of the type of information shared 

with the Federal Government under such subsection; 

‘‘(C) a review of the actions taken by the Federal Government based on such information; 

‘‘(D) appropriate metrics to determine the impact of the sharing of such information with the 

Federal Government on privacy and civil liberties, if 

any; 

‘‘(E) a list of the departments or agencies receiving such information; 

‘‘(F) a review of the sharing of such information within the Federal Government to identify inappropriate stovepiping of shared information; and 

‘‘(G) any recommendations of the Inspector 

General of the Department of Homeland Security 

for improvements or modifications to the authorities 

under such section. 

‘‘(2) PRIVACY AND CIVIL LIBERTIES OFFICERS REPORT.—The Officer for Civil Rights and Civil Liberties 

of the Department of Homeland Security, in consultation with the Privacy and Civil Liberties Oversight 

Board, the Inspector General of the Intelligence Community, and the senior privacy and civil liberties officer of 

each department or agency of the Federal Government 
12 

•HRES 164 EH 

that receives cyber threat information shared with the 

Federal Government under such subsection (b), shall annually and jointly submit to Congress a report assessing 

the privacy and civil liberties impact of the activities conducted by the Federal Government under such section 

1104. Such report shall include any recommendations 

the Civil Liberties Protection Officer and Chief Privacy 

and Civil Liberties Officer consider appropriate to minimize or mitigate the privacy and civil liberties impact of 

the sharing of cyber threat information under such section 1104. 

‘‘(3) FORM.—Each report required under paragraph (1) or (2) shall be submitted in unclassified form, 

but may include a classified annex. 

‘‘(d) DEFINITIONS.—In this section: 

‘‘(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term ‘appropriate congressional committees’ 

means— 

‘‘(A) the Committee on Homeland Security, the 

Committee on the Judiciary, the Permanent Select 

Committee on Intelligence, and the Committee on 

Armed Services of the House of Representatives; 

and 

‘‘(B) the Committee on Homeland Security 

and Governmental Affairs, the Committee on the 
13 

•HRES 164 EH 

Judiciary, the Select Committee on Intelligence, and 

the Committee on Armed Services of the Senate. 

‘‘(2) CYBER THREAT INFORMATION, CYBER THREAT

INTELLIGENCE, CYBERSECURITY CRIMES, CYBERSECURITY PROVIDER, CYBERSECURITY PURPOSE, AND SELFPROTECTED ENTITY.—The terms ‘cyber threat information’, ‘cyber threat intelligence’, ‘cybersecurity crimes’, 

‘cybersecurity provider’, ‘cybersecurity purpose’, and 

‘self-protected entity’ have the meaning given those 

terms in section 1104 of the National Security Act of 

1947, as added by section 3(a) of this Act. 

‘‘(3) INTELLIGENCE COMMUNITY.—The term ‘intelligence community’ has the meaning given the term in 

section 3(4) of the National Security Act of 1947 (50 

U.S.C. 401a(4)). 

‘‘(4) SHARED SITUATIONAL AWARENESS.—The 

term ‘shared situational awareness’ means an environment where cyber threat information is shared in real 

time between all designated Federal cyber operations 

centers to provide actionable information about all 

known cyber threats.’’. 

Page 5, strike line 6 and all that follows through page 

6, line 7. 
14 

•HRES 164 EH 

Page 7, beginning on line 17, strike ‘‘by the department 

or agency of the Federal Government receiving such cyber 

threat information’’. 

Page 13, strike line 13 and all that follows through page 

15, line 23. 

Page 17, strike line 15 and all that follows through page 

19, line 19. 

Attest: 

Clerk.